delivery-secretary
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions.
- Ingestion points: The skill reads project-specific documents such as execution plans, test lists, and a ledger file (ledger.json) as described in SKILL.md and references/ledger-and-views.md.
- Boundary markers: Data is ingested from structured JSON and markdown files without explicit delimiters or warnings to ignore embedded instructions in text fields.
- Capability inventory: The skill communicates with other agent roles and sends messages to threads using host tools (send_message_to_thread).
- Sanitization: The provided Python script validates the structure of the ledger, but semantic natural language content is processed without filtering for potential injection attempts.
- [COMMAND_EXECUTION]: The skill utilizes a local Python script for data processing and validation.
- Evidence: SKILL.md and references/ledger-and-views.md instruct the agent to execute python3 ledger.py to check the ledger structure and generate status reports.
- Context: The script is provided as a local component of the skill and utilizes only the Python standard library.
Audit Metadata